Is CVE-2026-34365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34365 being exploited in the wild.

How severe is CVE-2026-34365?

High severity, with a CVSS score of 7.6, published 31 March 2026.

Is there a fix for CVE-2026-34365?

A patch was published on 2026-03-24: Version 2.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34365 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34365?

Check whether you run Invoiceshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34365: InvoiceShelf SSRF in Estimate PDF generation module

CVE-2026-34365 · Severity: high · CVSS 7.6 · Published 2026-03-31

InvoiceShelf, an open-source platform for managing business expenses and invoices, contains a security flaw in its estimate generation system. An attacker with administrative access can inject malicious code into the 'Notes' field of an estimate, causing the server to make unauthorized requests to internal or external systems when a PDF is generated. This could allow an attacker to scan internal networks, access sensitive cloud metadata, or potentially read private files on the server.

Technologies: Invoiceshelf. Vendors: Invoiceshelf.

Quick answers

Is CVE-2026-34365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34365 being exploited in the wild.
How severe is CVE-2026-34365?: High severity, with a CVSS score of 7.6, published 31 March 2026.
Which products and versions are affected?: Invoiceshelf < 2.2.0.
Is there a fix for CVE-2026-34365?: A patch was published on 2026-03-24: Version 2.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34365 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34365?: Check whether you run Invoiceshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in InvoiceShelf prior to version 2.2.0. The application passes user-supplied HTML from the estimate 'Notes' field directly to the Dompdf rendering library without sanitization. When a PDF is previewed or viewed via the customer endpoint, Dompdf fetches any remote resources (such as images or stylesheets) referenced in the markup. This allows an authenticated attacker to perform internal network reconnaissance, access cloud metadata endpoints, or potentially read local files via the file:// wrapper. The issue is present in the Estimate PDF generation module and affects endpoints including /api/v1/estimates/{estimate}/send and /estimates/pdf/{unique_hash}. A patch is available in version 2.2.0.

Affected products

InvoiceShelf InvoiceShelf < 2.2.0

Timeline

2026-03-24: patched: Version 2.2.0 released
2026-03-27: advisory: GitHub Security Advisory published
2026-03-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.